Create a Connected AI personal access token
Open **Settings → Connected AI** when enabled for your workspace. Viewing connection details and creating a token require the respective permissions. A token is limited by both its selected permissions and your current staff role.
Create a token
1. On **Connect**, use **Other AI clients → Create token**.
2. Enter a recognizable **Label**.
3. Set **Expires in (days)** within the displayed limits. Use a defined expiry for temporary work. Zero means no expiry only where allowed.
4. Select only the needed **Permissions**; viewing data and performing actions are separate. Unavailable permissions cannot be granted.
5. Optionally set **Allowed IPs** to the IP addresses or CIDR ranges the AI client actually uses.
6. Select **Create token**.
Copy the one-time secret
In **Your new token**, copy **Personal access token** and store it privately before selecting **I have copied the token**. The secret is shown once. Use the workspace **MCP server URL** provided by its connection instructions; do not construct one from another workspace’s example.
Restricted financial permissions
If **Allow finance** is offered, enabling it exposes additional restricted actions. Those tokens require the IP and expiry restrictions shown by the form. Grant them only to a client that needs them; selecting a scope does not expand your staff role. Do not use an unrestricted network rule to work around a validation error.
Review and revoke
Open **Connections** to see active personal tokens and connected apps. The table includes Type, Permissions, Last used, and Expires. Choose **Revoke** on the intended personal token and confirm to stop its access. Authorized managers can use **Show all staff**. A revoked token must be replaced if the client should connect again.
A token was created but not shown
If the form says the one-time secret was not returned, close it, find and revoke that token in Connections, then create a replacement. Do not repeatedly submit creation. Keep tokens out of website code, customer messages, screenshots, and repository commits.